Critical Authentication Bypass in Apache HTTP Server 2.4.x
Summary
ALPINE-CVE-2026-73636: Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication crede... Affects apache2 versions < 2.4.69-r0. Fixed in 2.4.69-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, security features, and extensive documentation. However, a recent vulnerability has been identified in the mod_auth_digest module of Apache HTTP Server 2.4.x, which could allow attackers to exploit authentication mechanisms.
Vulnerability Detail
The vulnerability, identified as CVE-2026-73636, allows for an authentication bypass through capture-replay attacks in the mod_auth_digest module. This issue arises when the AuthDigestNonceLifetime is set to 0, enabling a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials. The implications of this vulnerability are severe, as it can lead to unauthorized access to sensitive information and systems, compromising the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
2.4.69-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can set the AuthDigestNonceLifetime to a value greater than 0 to mitigate the risk of replay attacks until the upgrade can be performed.
Conclusion
In summary, CVE-2026-73636 represents a critical vulnerability in Apache HTTP Server 2.4.x that allows for authentication bypass through replay attacks. Users are strongly encouraged to upgrade to version 2.4.69 or later to mitigate this risk. Temporary workarounds are available, but a permanent fix through upgrading is recommended.
See every vulnerability recorded for apache2 →
FAQ
CVE-2026-73636 is a vulnerability in the Apache HTTP Server that allows for authentication bypass through capture-replay attacks.
If your server is running Apache HTTP Server 2.4.x with mod_auth_digest enabled, it may be susceptible to unauthorized access by attackers.
As a temporary measure, you can set the AuthDigestNonceLifetime to a value greater than 0 to reduce the risk of exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
